This privacy notice makes clear how your personal data is collected, processed and stored securely to comply with the new GDPR law of 25th May 2018. It also covers your legal rights. This notice applies to counselling and coaching clients or potential clients only.
About me and Butterfly Counselling
My name is Wendie Ralphs and I am the sole owner of Butterfly Counselling. As such I am both the data controller and data processor. I am registered with ICO my registration number is Z3230853.
I am contactable on:
I ensure that only data that is ‘absolutely necessary for the completion of duties’ is processed and stored.
I ensure that your data is processed lawfully and fairly and in a transparent manner.
I ensure that your data is accurate and where necessary, kept up to date.
I ensure that your data is secure.
I ensure that your data is NOT kept longer than is absolutely necessary.
What kind of data is collected?
Data collected from a private individual (client or potential client):
For me to deliver the service I will need to collect your contact details. I will also record dates of attendance, whether we work online or face to face at my location. Additional data: You may choose to share (either verbally or in writing) data regarding your personal circumstances which may include sensitive data. IMPORTANT: I ONLY collect, process and store factual, objective data. This may include sensitive data. Any data you or anyone else chooses to share with me which is outside of this remit, such as subjective opinions, will not be processed and will be securely destroyed. Please note that use of the website contact form informs of your IP address.
Data collected from a business/organisation making a referral for counselling or coaching:
For me to deliver the service I will need to collect contact details of the organiser, contact details of the person being referred, address and contact details of paymaster, invoicing data, details of any specific requirements, e.g. ‘can only attend after 4 pm’. I will also need to collect the reason for the referral for counselling/coaching. Additional data: The referrer may choose to share (either verbally or in writing) personal circumstances pertaining to the person being referred for counselling/coaching, which may include sensitive data. IMPORTANT: I ONLY collect, process and store factual, objective data. This may include sensitive data. Any data outside of this remit, such as subjective opinions, will be not be processed and will be securely destroyed. Please note that use of the website contact form informs of your IP address.
Data collected from general enquirers:
I will respond appropriately to enquires about the counselling or coaching service. Should you be enquiring in about counselling/coaching on behalf of someone other than yourself and share data about this person – I will securely destroy any personal data regarding the other person, following my response to you. Should the person choose to take up the service, I will inform them of what I already know, via you, the 3rd party. IMPORTANT: I ONLY collect, process and store factual, objective data. This may include sensitive data. Any data outside of this remit, such as subjective opinions, will be not be processed and will be securely destroyed. Please note that use of the website contact form informs of your IP address.
How is data collected?
Data is collected in the following ways:
Online contact form via the web host, Fasthosts.
Online contact form via the Counselling Directory contact form.
By phone. By text. In person.
Data that you choose to disclose in the public arena such as the Butterfly Counselling & Coaching Facebook page is done so at your own discretion. I do not use the Facebook messaging platform – I have chosen to deactivate this system.
Use of information
In accordance with this data retention schedule, there may be occasions when data is not destroyed due to an ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
- Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
- Any document containing personal data will state “Private and Confidential” clearly.
- All emails will contain a privacy statement.
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- the right not to be subject to automated decision-making including profiling
When an individual, visits www.butterflycounselling.com I use Google analytics who is considered a third-party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Wendie Ralphs – Butterfly Counselling will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.
Fasthosts is a third-party service that hosts Wendie Ralphs – Butterfly Counselling’s website. Fasthosts also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website. Fasthosts privacy notice can be found here for further information: www.fasthosts.co.uk/terms/privacy-policy
Cookies are small text files that are placed on your computer’s hard drive by your web browser when you visit any website. They allow information gathered on one web page to be stored until it is needed for use on another, allowing a website to provide you with a personalised experience and the website owner with statistics about how you use the website so that it can be improved. Some cookies may last for a defined period of time, such as one day or until you close your browser. Others last indefinitely.
To track how you use my website
To record whether you have seen specific messages I display on our website
I use MailChimp which is a third-party electronic database and mailing system. For the purpose of sending promotional material as advertised on my website. Name and email address details are kept (if consent has been given) unless you unsubscribe. Both database and the mailing system are password protected – you can find out more information here www.mailchimp.com/legal/privacy
Retention of Data Schedule
- Emails (including sent items)
- Email is deleted once actioned
- Text messages (including sent items)
- Text messages deleted once actioned
- Contact details held on a mobile device
- 7 years from the request being submitted and completed.
- All entries will be deleted prior to decommissioning of mobile device or reissue of device
- Images were taken for promotional materials
- 5 years or earlier if consent is withdrawn.
- Until superseded – consent to be rechecked prior to reissue
- Paper diaries
- 7 years from the period in which its use ends
- Until new policy has been put into place
- Client records including session notes, initial consultation notes and review form
- 7 years after final treatment session has ended
- Service evaluation records
- Transfer to anonymised data within 6 months of collection
- Tax returns
- 7 years from the end of the financial period to which they pertain to
- Subject Access Request
- 7 years from the request being submitted and completed
- Right to erasure
- 7 years from the request being submitted and completed
- Right to a correction
- 7 years from the request being submitted and completed
- 2 years from complaint being resolved
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
What are the lawful basis for processing data at Wendie Ralphs – Butterfly Counselling?
- The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personnel file.
- Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
- Processing is necessary for your legitimate interests:
- Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
- Paragraph 1 above shall not apply if one of the following applies:
Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, the provision of health or social care.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ/Terms and Conditions for treatment document, which compliments the policy detailed here.
Reasons/purposes for processing information
Wendie Ralphs – Butterfly Counselling processes personal information to enable the provision of Counselling and Coaching, to advertise services and to maintain accounts and records.
Type/classes of information processed
Wendie Ralphs – Butterfly Counselling processes information relevant to the above reasons/purposes. This information may include:
- personal details
- family, lifestyle and social circumstances
- goods and services
- financial details
- employment and education details
Wendie Ralphs – Butterfly Counselling also processes sensitive classes of information that may include:
- physical or mental health details
- racial or ethnic origin
- religious or other beliefs of a similar nature
Wendie Ralphs – Butterfly Counselling processes personal information about:
- business contacts
- professional advisers
All personal and sensitive data held by Wendie Ralphs – Butterfly Counselling is held securely. Electronic data stored on a computer is stored on a password-protected computer, in a password protected document held on OneDrive. This is an online a file hosting service operated by Microsoft which required a double sign in. (This supports the ability to retrieve data in the event of faults or loss).
I also store a backup of my computer on an external hard drive, which is stored in a locked cabinet behind a locked door. (This supports the ability to retrieve data in the event of faults or loss). Hardcopy data is held securely in a locked cabinet behind a locked door.
In the case of a data breach Wendie Ralphs – Butterfly Counselling shall comply with the regulations set out in Article 33 of the GDPR:
- In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
- The notification referred to in paragraph 1 shall at least:
- describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and the approximate number of personal data records concerned:
- communicate the name and contact details of the data controller where more information can be obtained:
- describe the likely consequences of the personal data breach:
- describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
- The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action is taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
- In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
- If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.
Subject Access Request
Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records unless the application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information I hold about you, Wendie Ralphs – Butterfly Counselling will:
- give you a description of it;
- tell you why I am holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
SAR requests should be put in writing to Wendie Ralphs – Butterfly Counselling. A response may be provided informally over the telephone with your agreement, or formally by letter or email.
If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing.
I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Wendie Ralphs – Butterfly Counselling.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until 7 years after the request was made.
Wendie Ralphs – Butterfly Counselling hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Wendie Ralphs – Butterfly Counselling would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Wendie Ralphs – Butterfly Counselling.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by Wendie Ralphs – Butterfly Counselling, you can contact me directly. In the event that I am unable to resolve your complaint to your satisfaction, you can contact the Information Commissioners Office on 0303 123 1113.
Safeguarding your privacy
In the event of my death or sudden illness, a nominated colleague will contact existing clients and archive any client files in accordance with General Data Protection Regulations.
- Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75-minute GDPR CPD Course provided by the Clinical Hypnotherapy School (clinicalhypnotherapyschool.com) completed. Refresher training is completed every two years.
- Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.
- Any data collected is solely for the purpose of providing a client-centered service to an individual client, a class or workshop.
- The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. (https://www.igt.hscic.gov.uk/Caldicott2Principles.aspx)
- All technology Microsoft Office products including Outlook, OneDrive, as well as Apple Mail, used to store or facilitate information and communication is maintained according to the Data Retention Policy for Wendie Ralphs – Butterfly Counselling.
- All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
- It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
- Any electronic devices where personal or sensitive, confidential information is held will be password protected. Individual documents stored electronically will also contain individual passwords.
- Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.